This release combines reviewed process-management dependency maintenance with account access warning and recovery controls. Each part passed its own applicable review, backup and live checks before this announcement.

The installed dependency bundle includes basic-ftp 6.2.1, chokidar 4.0.3 and readdirp 4.1.2. The affected brace parser has been removed from this bundle. The existing website build remains in place.

Account access warnings describe a newly observed network or reported device using a half-hidden IP address, an approximate country and the UTC date and time. Device details are reported by the browser, and the country can be Unknown. The warning does not assert that an account has been compromised.

Delivery uses only the current active verified email address once both its establishment and verification are strictly older than seven days. The release starts a conservative observation period; warning delivery becomes eligible only after that period, and changing the address restarts the wait.

Opening the recovery page does not change an account. An explicit “This was not me” confirmation revokes sessions, requires a password reset and preserves existing multifactor and passkey settings. Warning emails can be disabled while the recovery protections and outstanding recovery links remain available.

The first fully completed login after this update establishes a single default IP for the account, stored only as an account-scoped keyed fingerprint. Existing explicit IP approvals are preserved. Later logins cannot replace the default. Email changes from another IP remain locked until the owner confirms “This was me” through the current verified account email; that replaces the default IP. The default remains recognised until explicitly replaced. “Wasn’t me” signs out account sessions, requires a password reset and blocks default trust until the owner verifies it again, including when recovery began before a default was established. Team, database, chat and bot actions also bind the acting account to its authenticated session and the selected resource to the requested URL, with permissions checked before changes.

7 October 2026 security update: a completed sign-in from an unrecognised IP is blocked before any browser credential is returned. The current verified email must approve that requesting IP, followed by a fresh sign-in. Email changes stay locked during review and for seven days after approval. Approval never restores the blocked session. “Wasn’t me” signs out account sessions, revokes secondary credentials and requires password recovery while retaining MFA/passkeys. Local aggregate request and connection limits, bounded application concurrency, reserved recovery capacity and bounded attack logging protect origin resources without requiring an external mitigation service. The internal AI provider is restricted to loopback and SSH connection budgets preserve existing administrative access. Three focused security dependency patches address proxy trust, image processing and source-map handling. These controls cannot absorb a flood that saturates the upstream network connection. The product homepage is unchanged.